How much are BIPA statutory damages?

BIPA is the state privacy law that carries a real price tag for getting it wrong, because Illinois wrote fixed damages into the statute and let individuals sue directly. If you run a fingerprint time clock, a face-recognition feature, or any voiceprint tool, the size of the exposure is not a guess. It is set in Section 20, and a 2023 ruling plus a 2024 amendment changed how those numbers add up.

What does Section 20 award?

Under 740 ILCS 14/20, any person aggrieved by a violation of BIPA has a right of action, and a prevailing party recovers, for each violation, the greater of liquidated or actual damages. A negligent violation is $1,000 or actual damages, whichever is greater. An intentional or reckless violation is $5,000 or actual damages, whichever is greater. On top of that, the court awards reasonable attorneys' fees and costs, including expert witness fees, and can order injunctive relief. The fee-shifting is a large part of why BIPA cases settle: the damages are fixed and the defendant funds the plaintiff's lawyers.

Is $1,000 or $5,000 automatic?

Not quite. The statute says a prevailing party "may" recover those amounts, and in Cothron v. White Castle the Illinois Supreme Court read that word as giving trial courts discretion over the size of an award rather than forcing a mechanical multiplication. That discretion matters most in class actions, where a literal per-violation calculation can reach figures a court may see as disproportionate. The ceiling is still $1,000 or $5,000 per violation; the point is that a judge is not required to award the maximum.

How the per-scan rule and the 2024 cap interact

Two changes reshaped exposure. First, Cothron held that a separate claim accrues on each scan or transmission that violates Section 15(b) or 15(d), not only the first. That reading multiplied potential violations across years of daily fingerprint scans. Then Public Act 103-769, effective August 2, 2024, added Section 20(b) and (c): repeatedly collecting or disclosing the same biometric identifier from the same person by the same method is a single violation with, at most, one recovery. So post-amendment conduct no longer stacks one violation per scan, though the reach of the amendment to earlier conduct is still being litigated.

How long is the exposure window?

BIPA claims run under a five-year limitations period set in Tims v. Black Horse Carriers, so a demand can look back across several years of collection. Combined with per-violation damages and fee-shifting, that window is what turns a routine biometric feature into a material liability. The Illinois BIPA overview sets out the underlying notice, consent, and retention duties whose breach triggers Section 20 in the first place.

Next step

If you capture fingerprints, faces, or voiceprints from anyone in Illinois, the free 2-minute Obligation Scan checks whether BIPA applies and lists the notice, written-release, and retention steps that keep you out of Section 20 exposure. The US state privacy laws hub shows how Illinois's damages compare with the attorney-general-only enforcement in states like Texas.